Privacy Policy

TodsAI LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, operates the website and the service. Contact: hello@nelxa.com. Data protection contact: hello@todsai.com.

For visitors of this website and for the people who hold Nelxa accounts (agency staff), we are the controller.

For the personal data an agency stores in its workspace about its travellers and business contacts, the agency is the controller and we are its processor, acting on its instructions under the Data Processing Agreement. If you are a traveller and have questions about your data in an agency's workspace, please contact that agency first; we will help it respond.

The website sets one strictly necessary cookie (nelxa_site_lang) to remember your language choice. It does not use advertising or tracking cookies. If we enable web analytics, it runs without cookies and without identifying you.

Our hosting provider keeps standard server logs (IP address, requested page, browser type, time) for security and operations.

If you request a demo, we process the details you enter (name, email, agency name, optional phone, team size, message and your language) to answer you and, if you become a customer, to set up your account. We keep them as long as needed to follow up.

When you create an account we process your name, email address and, if you sign in with Google, the profile details Google provides. Authentication is handled by Firebase Authentication; sessions use a signed cookie.

While you use the service we record which workspace you belong to and with which role, and actions attributed to your account, such as automation runs, edits and signatures collected, so the agency has a reliable audit trail. Support conversations are kept to resolve your request.

Depending on what the agency enters, a workspace can hold, per traveller: name and contact details; identity document details (passport or ID card number, expiry, uploaded scans) needed for bookings; communication language; household and family links; travel history; instalment schedules, payments, refunds and payment declarations; contracts, signatures with time, address and browser; portal sign-in codes and messages; and, for group passengers, dietary requirements, medical notes and emergency contacts.

We do not use this data for our own purposes, do not sell it and do not use it to train AI models. Uploaded files are stored under server-controlled, per-agency paths; identity document numbers are stored in the workspace database and are visible only to the agency's staff according to their role.

The database (PostgreSQL) runs on Supabase in Frankfurt, Germany. The application runs on Google Cloud (Firebase App Hosting) in the europe-west4 region, and PDFs are rendered by a private service on Google Cloud Run in the same region. Sign-in uses Firebase Authentication, a global Google service; uploaded files are stored in Firebase Storage in the European Union.

When an agency connects services of its own, data flows to them as needed: Stripe (card payments, the agency's own Stripe account); the agency's chosen email provider (Brevo, Resend or its own SMTP server) for emails to travellers; an AI provider (OpenAI, Anthropic or Google) only when the agency has entered its own key and only for the content it submits; Google Calendar when connected. Lookups for flight numbers (AeroDataBox), places (Google Places) and stock photos (Unsplash, Pexels, Pixabay) send only the search terms.

The full list, with locations, is on the Data Processing Agreement page. Where a provider processes data outside the EU/EEA, the transfer relies on the safeguards in that provider's terms, such as the EU Standard Contractual Clauses.

Account data is kept while the account exists. Workspace data is kept while the workspace is active. Records an agency deletes go to the workspace trash and are permanently purged 30 days after deletion; trips that hold financial records (payments, refunds, adopted amendments) are retained for accounting instead of being purged. Signed contracts keep the snapshot they were signed against for the life of the trip.

When a workspace is closed, we delete or return its data as agreed in the Data Processing Agreement, except where the law requires longer retention.

Every record carries its agency and PostgreSQL row-level security enforces that boundary; API routes check the user, the workspace and the role on every request. Traffic is encrypted in transit. Provider keys entered by agencies are encrypted at rest (AES-256-GCM). Portal links are personal tokens with expiry and one-time codes are rate-limited. Deleted records are recoverable before purge, and automation runs and signatures are logged.

Under the GDPR you can ask for access to your personal data, rectification, erasure, restriction, portability, and you can object to processing based on legitimate interests. Write to hello@nelxa.com. If you are a traveller, your agency is the controller of the data in its workspace and can act on your request directly; we support it in doing so.

You also have the right to lodge a complaint with the data protection supervisory authority of the EU member state where you live, work or where the alleged infringement took place; in Greece this is the Hellenic Data Protection Authority (www.dpa.gr).

Nelxa accounts are for business users. Agencies may record travellers of any age (for example children on a family booking); doing so is the agency's responsibility as controller.

We update this policy when the software or the law changes. The date at the top shows the current version; material changes are announced to account owners.